Audit Kerberos Service Ticket Operations
Some detection rules require monitoring Kerberos service ticket requests to identify unusual or potentially malicious access to services. This audit policy applies exclusively to Domain Controllers, as other servers do not produce these events.
To enable Audit Kerberos Service Ticket Operations on all Domain Controllers via Group Policy, administrators must enable the Audit Kerberos Service Ticket Operations policy. Follow these steps to configure the audit policy via Advanced Audit Policies Configuration:
Computer Configuration >
Policies >
Windows Settings >
Security Settings >
Advanced Audit Policies Configuration >
Audit Policies >
Account Logon >
Audit Kerberos Service Ticket Operations (Success,Failure)
To enable this policy on a local Domain Controller, run the following command in an elevated command prompt:
auditpol.exe /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
When this audit policy is enabled, the following event IDs may be generated:
- 4769: A Kerberos service ticket was requested.
- 4770: A Kerberos service ticket was renewed.
- 4773: A Kerberos service ticket request failed.
Use the following GitHub search to identify rules that use the events listed: